Har jag fått in ett virus i datorn?

26 oktober, 2010

Hej, sedan ett par dagar kan jag inte öppna vissa program, anpassa utseende.

När jag klickar på, Tema, Bildskärmsinställningar och Skärmsläckare får jag samma meddelande. Allt detta fungerade fint tidigare. Jag kan inte prova "system restore". Finns inga återställningspunkter för tiden innan problemen började.

Ett par andra saker:

MSI afterburner startade tidigare med Vista. Gör det inte längre trots att det står så i inställningar.

Logitec Setpoint går inte att uppdatera, inte heller att avinstallera. Samma meddelande men med en annan filhänvisning.

Vet inte om det är fler saker som inte fungerar som det ska. Har inte kollat allt.

Tacksam för all hjälp.

Bifogar en bild. Vad är "Metropolis" som finns i regedit i bakgrunden?

Edit: Asus AI-suite fungerar inte heller.

26 oktober, 2010

Hej,

Installera Malwarebytes, hittas här:

Malwarebytes' Anti-Malware

Kör en snabbskanner, och följ programmets instruktioner, när det hittar något.

Klistra in loggen från körningen, här i din tråd, loggar hittas under fliken Loggar.

Gör sedan detta.

Om något antivirus- eller antispionprogram har hittat något skadligt så klistra in en logg där det framgår vad som har hittats och vilka filer och mappar som är inblandade.

Klistra in loggen/resultatet från programmet DDS. Spara DDS på Skrivbordet.

http://download.blee...om/sUBs/dds.scr

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil.

DDS är ett program som listar processer som kör, program och tjänster som startas automatiskt samt filer i sådana mappar som är vanliga att skadliga program och som är nya eller ändrade under senaste 1-3 månader. DDS är ett mycket vanligt program bland oss som hjälper till att rensa datorer. Resultatet ger oss en grundläggande kunskap om vad som händer och har hänt nyligen i datorn, och från det kan vi dra slutsatser om vad som är nästa lämpliga steg i rensningen av datorn.

Obs! När du klistrar in en logg eller ett resultat i ditt inlägg använd inga knappar eller taggar utan kopiera det i programmet (oftast Anteckningar) och klistra in det direkt i rutan du skriver i.

Mvh

Mats H

26 oktober, 2010

Hej Mats och tack för ett snabbt svar.

Jag har scannat med de program du har angett. Malwarebytes hittade en massa otrevliga saker.

Mitt antivirus program, Avira Personal, hittar ingenting.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Databasversion: 4951

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18975

2010-10-26 15:30:32

mbam-log-2010-10-26 (15-30-32).txt

Skanningstyp: Snabbskanning

Antal skannade objekt: 133371

Förfluten tid: 4 minut(er), 16 sekund(er)

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 1

Infekterade registernycklar: 3

Infekterade registervärden: 1

Infekterade registerdataposter: 0

Infekterade mappar: 0

Infekterade filer: 15

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

Infekterade minnesmoduler:

C:\Windows\System32\sshnas21.dll (Rootkit.TDSS) -> No action taken.

Infekterade registernycklar:

HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\X3EKEPXJP2 (Trojan.FakeAlert) -> No action taken.

Infekterade registervärden:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metropolis (Rootkit.TDSS) -> No action taken.

Infekterade registerdataposter:

(Inga illasinnade poster hittades)

Infekterade mappar:

(Inga illasinnade poster hittades)

Infekterade filer:

C:\Windows\System32\sshnas21.dll (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$R0QOXI0.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$R1FG14I.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$RO6VADC.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$RCQOJDI.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$RUSBQTR.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$RVSECZX.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$RZM57FC.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$R3URR1E.exe (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$RJUQYQW.dll (Rootkit.TDSS) -> No action taken.

C:\$Recycle.Bin\S-1-5-21-4174663696-2328483515-1376522649-1000\$RM3E2G1.exe (Rootkit.TDSS) -> No action taken.

C:\Windows\Qgukaa.exe (Rootkit.TDSS) -> No action taken.

C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job (Trojan.Downloader) -> No action taken.

C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> No action taken.

C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> No action taken.

DDS log:

DDS (Ver_10-10-21.02) - NTFSx86

Run by Lennart at 15:40:19,13 on 2010-10-26

Internet Explorer: 8.0.6001.18975 BrowserJavaVersion: 1.6.0_20

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.46.1053.18.3326.2045 [GMT 2:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-

FDD3350758C7}

SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\V0230Mon.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\A4Tech\Mouse\Amoumain.exe

E:\Spel Vista\Steam\Steam.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Windows\system32\PnkBstrA.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Lennart\Desktop\dds.scr

C:\Windows\system32\conime.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ch/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program

files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program

files\java\jre6\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program

files\java\jre6\bin\jp2ssv.dll

uRun: [steam] "e:\spel vista\steam\steam.exe" -silent

uRun: [Metropolis] rundll32.exe c:\windows\system32\sshnas21.dll,GetHandle

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [MSIAfterburner] "c:\program files\msi afterburner\MSIAfterburnerWrapper.exe" /s

mRun: [V0230Mon.exe] c:\windows\V0230Mon.exe

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe

mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

mRun: [WheelMouse] c:\program files\a4tech\mouse\Amoumain.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0

\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-

malware\mbamgui.exe /install /silent

StartupFolder: c:\users\lennart\appdata\roaming\micros~1\windows\startm~1

\programs\startup\logite~1.lnk - c:\program files\common

files\logishrd\ereg\setpoint\eReg.exe

StartupFolder: c:\users\lennart\appdata\roaming\micros~1\windows\startm~1

\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\winzip~1.lnk -

c:\program files\winzip\WZQKPICK.EXE

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-

1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-

1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-

1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -

hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1

\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath -

c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\

FF - component:

c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\extensions\{a7

c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll

FF - component:

c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\extensions\ffx

tlbr@facemoods.com\components\FFHst.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\veetle\player\npvlc.dll

FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll

FF - plugin:

c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\extensions\bat

tlefieldheroespatcher@ea.com\platform\winnt_x86-msvc\plugins\npBFHUpdater.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-

08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation

foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.visited_color",

"#551A8B");

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

fiqz9s", true); // Traditional

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

fiqs8s", true); // Simplified

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

j6w193g", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

mgberp4a5d4a87g", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

mgbqly7c0a67fbc", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

mgbqly7cvafr", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

kpry57d", true); // Traditional

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--

kprw13d", true); // Simplified

c:\program files\mozilla firefox\defaults\pref\firefox-l10n.js - pref

("browser.fixup.alternate.suffix", ".se");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref

("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-15 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir

desktop\sched.exe [2009-9-15 135336]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe

[2009-9-15 267432]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-15 60936]

R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-8-2 20328]

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein

hamachi\hamachi-2.exe [2010-3-30 1107336]

R3 EverestDriver;Lavalys EVEREST Kernel

Driver;c:\users\lennart\appdata\local\temp\EverestDriver.sys [2010-10-26 26224]

R3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k

LocalServiceAndNoImpersonation [2009-9-15 21504]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-10-26

38224]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN

v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18

130384]

S3 RTCore32;RTCore32;c:\program files\msi afterburner\RTCore32.sys [2009-10-19 12088]

S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program

files\sisoftware\sisoftware sandra lite 2009\RpcAgentSrv.exe [2010-8-15 98488]

S3 V0230Vfx;V0230Vfx;c:\windows\system32\drivers\V0230Vfx.sys [2009-11-6 6272]

S3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\drivers\V0230VID.sys [2009-11-6

509760]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache

4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3

-18 753504]

=============== Created Last 30 ================

2010-10-26 13:23:23 -------- d-----w-

c:\users\lennart\appdata\roaming\Malwarebytes

2010-10-26 13:23:09 38224 ----a-w- c:\windows\system32

\drivers\mbamswissarmy.sys

2010-10-26 13:23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-26 13:23:08 -------- d-----w- c:\program files\Malwarebytes'

Anti-Malware

2010-10-26 13:23:08 -------- d-----w- c:\progra~2\Malwarebytes

2010-10-26 12:14:27 388608 ----a-w- C:\HijackThis.exe

2010-10-25 23:25:36 81920 ----a-w- c:\windows\eSellerateControl350.dll

2010-10-25 23:25:36 356352 ----a-w- c:\windows\eSellerateEngine.dll

2010-10-25 23:25:36 -------- d-----w- c:\program files\Rundll Errors

Fix Wizard

2010-10-25 15:31:37 249856 ----a-w- c:\windows\Qgukaa.exe

2010-10-25 15:31:12 303104 ----a-w- c:\windows\system32\sshnas21.dll

2010-10-22 12:33:04 6146896 ----a-w- c:\progra~2\microsoft\windows

defender\definition updates\{98c8770f-b8ee-4542-b8f8-5aa42f220b93}\mpengine.dll

2010-10-19 10:29:14 888424 ----a-w- c:\windows\system32\nvdispco322050.dll

2010-10-19 10:29:14 813672 ----a-w- c:\windows\system32\nvgenco322030.dll

2010-10-19 10:29:14 57960 ----a-w- c:\windows\system32\OpenCL.dll

2010-10-19 10:29:14 5399656 ----a-w- c:\windows\system32\nvwgf2um.dll

2010-10-19 10:29:14 4836456 ----a-w- c:\windows\system32\nvcuda.dll

2010-10-19 10:29:14 2911848 ----a-w- c:\windows\system32\nvcuvid.dll

2010-10-19 10:29:14 2666088 ----a-w- c:\windows\system32\nvcuvenc.dll

2010-10-19 10:29:14 1718376 ----a-w- c:\windows\system32\nvapi.dll

2010-10-19 10:29:14 14899816 ----a-w- c:\windows\system32\nvoglv32.dll

2010-10-19 10:29:14 13019752 ----a-w- c:\windows\system32

\nvcompiler.dll

2010-10-19 10:29:14 10055304 ----a-w- c:\windows\system32

\drivers\nvlddmkm.sys

2010-10-19 10:29:14 10021992 ----a-w- c:\windows\system32\nvd3dum.dll

2010-10-13 23:44:18 8147456 ----a-w- c:\windows\system32\wmploc.DLL

2010-10-13 23:44:18 168960 ----a-w- c:\program files\windows media

player\wmplayer.exe

2010-10-13 23:44:08 125952 ----a-w- c:\windows\system32\srvsvc.dll

2010-10-13 23:44:07 304128 ----a-w- c:\windows\system32\drivers\srv.sys

2010-10-13 23:44:07 17920 ----a-w- c:\windows\system32\netevent.dll

2010-10-13 23:44:07 145408 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-10-13 23:44:07 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2010-10-13 23:44:02 274944 ----a-w- c:\windows\system32\schannel.dll

2010-10-13 23:44:00 339968 ----a-w- c:\program files\windows

nt\accessories\wordpad.exe

2010-10-13 23:44:00 1316864 ----a-w- c:\windows\system32\ole32.dll

2010-10-12 18:40:24 -------- d-----w-

c:\users\lennart\appdata\local\Google

2010-10-08 00:03:52 600680 ----a-w- c:\windows\system32\nvvsvc.exe

2010-10-08 00:03:52 1881704 ----a-w- c:\windows\system32\nvsvcr.dll

2010-10-08 00:03:52 110696 ----a-w- c:\windows\system32\nvmctray.dll

2010-10-08 00:03:46 3416680 ----a-w- c:\windows\system32\nvcpl.dll

2010-10-08 00:03:40 2079336 ----a-w- c:\windows\system32\nvsvc.dll

2010-10-05 20:40:13 2601752 ----a-w- c:\windows\system32\pbsvc_moh.exe

2010-10-04 23:59:24 -------- d-----w- c:\program

files\SystemRequirementsLab

2010-09-29 09:37:31 2048 ----a-w- c:\windows\system32\tzres.dll

2010-09-29 09:37:03 13312 ----a-w- c:\program files\internet

explorer\iecompat.dll

==================== Find3M ====================

2010-10-19 09:41:44 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-10-09 23:18:36 234280 ----a-w- c:\windows\system32\PnkBstrB.xtr

2010-10-09 21:39:45 234280 ----a-w- c:\windows\system32\PnkBstrB.exe

2010-10-09 21:27:06 138056 ----a-w-

c:\users\lennart\appdata\roaming\PnkBstrK.sys

2010-10-09 21:26:40 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

2010-10-09 21:26:40 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe

2010-10-08 00:03:52 600680 ----a-w- c:\windows\system32\nvvsvc.exe

2010-09-08 06:01:28 916480 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 05:57:18 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 05:57:05 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2010-09-08 05:56:53 71680 ----a-w- c:\windows\system32\iesetup.dll

2010-09-08 05:56:53 109056 ----a-w- c:\windows\system32\iesysprep.dll

2010-09-08 05:04:36 385024 ----a-w- c:\windows\system32\html.iec

2010-09-08 04:26:46 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2010-09-08 04:25:15 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-08-31 21:07:56 2316 ----a-w- c:\progra~2\xmlE6BA.tmp

2010-08-31 21:07:56 10390 ----a-w- c:\progra~2\xmlE503.tmp

2010-08-31 21:07:56 0 ----a-w- c:\progra~2\xmlE61D.tmp

2010-08-31 15:46:37 954752 ----a-w- c:\windows\system32\mfc40.dll

2010-08-31 15:46:37 954288 ----a-w- c:\windows\system32\mfc40u.dll

2010-08-31 15:44:31 531968 ----a-w- c:\windows\system32\comctl32.dll

2010-08-31 13:27:38 2038272 ----a-w- c:\windows\system32\win32k.sys

2010-08-26 16:37:45 157184 ----a-w- c:\windows\system32\t2embed.dll

2010-08-20 16:05:07 867328 ----a-w- c:\windows\system32\wmpmde.dll

2010-08-17 14:11:37 128000 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-15 12:36:15 319456 ----a-w- c:\windows\DIFxAPI.dll

============= FINISH: 15:40:36,76 ===============

Jag är ledig, så om du har tid kan vi se om det går att ordna det här i idag.

Än en gång. Tack för att du hjälper nig.

Attach.txt

26 oktober, 2010

Kör Malwarebytes Antimalware en gång till och välj att åtgärda alla problem, glöm inte att uppdatera Malwarebytes Antimalware innan fullständig genomsökning.

Följ sedan instruktionerna för DDS en gång till.

26 oktober, 2010

Efter rensning scannade jag en gång till med Malwarebytes och då hittades inget.

Problemet med Skärmsläckare och de andra finns dock kvar, plus att jag kan inte öppna antivirus programmat från genvägen i aktivitetsfältet. Från skrivbordet fungerar det, men det går inte att för rootkits och active malware.

Här kommer loggar.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Databasversion: 4953

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18975

2010-10-26 17:17:48

mbam-log-2010-10-26 (17-17-48).txt

Skanningstyp: Snabbskanning

Antal skannade objekt: 133509

Förfluten tid: 3 minut(er), 47 sekund(er)

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 0

Infekterade registernycklar: 0

Infekterade registervärden: 0

Infekterade registerdataposter: 0

Infekterade mappar: 0

Infekterade filer: 0

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

Infekterade minnesmoduler:

(Inga illasinnade poster hittades)

Infekterade registernycklar:

(Inga illasinnade poster hittades)

Infekterade registervärden:

(Inga illasinnade poster hittades)

Infekterade registerdataposter:

(Inga illasinnade poster hittades)

Infekterade mappar:

(Inga illasinnade poster hittades)

Infekterade filer:

(Inga illasinnade poster hittades)

DDS (Ver_10-10-21.02) - NTFSx86

Run by Lennart at 17:20:14,05 on 2010-10-26

Internet Explorer: 8.0.6001.18975 BrowserJavaVersion: 1.6.0_20

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.46.1053.18.3326.2222 [GMT 2:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Windows\system32\PnkBstrA.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\V0230Mon.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\A4Tech\Mouse\Amoumain.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

E:\Spel Vista\Steam\Steam.exe

C:\Program Files\Common Files\Steam\SteamService.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\DllHost.exe

C:\Users\Lennart\Desktop\dds.scr

C:\Windows\system32\conime.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ch/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

uRun: [steam] "e:\spel vista\steam\steam.exe" -silent

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [MSIAfterburner] "c:\program files\msi afterburner\MSIAfterburnerWrapper.exe" /s

mRun: [V0230Mon.exe] c:\windows\V0230Mon.exe

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe

mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

mRun: [WheelMouse] c:\program files\a4tech\mouse\Amoumain.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

StartupFolder: c:\users\lennart\appdata\roaming\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\common files\logishrd\ereg\setpoint\eReg.exe

StartupFolder: c:\users\lennart\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\

FF - component: c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll

FF - component: c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\extensions\ffxtlbr@facemoods.com\components\FFHst.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\veetle\player\npvlc.dll

FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll

FF - plugin: c:\users\lennart\appdata\roaming\mozilla\firefox\profiles\vm08kg2l.default\extensions\battlefieldheroespatcher@ea.com\platform\winnt_x86-msvc\plugins\npBFHUpdater.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified

c:\program files\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-15 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-9-15 135336]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-9-15 267432]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-15 60936]

R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-8-2 20328]

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2010-3-30 1107336]

R3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-9-15 21504]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\users\lennart\appdata\local\temp\EverestDriver.sys [2010-10-26 26224]

S3 RTCore32;RTCore32;c:\program files\msi afterburner\RTCore32.sys [2009-10-19 12088]

S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra lite 2009\RpcAgentSrv.exe [2010-8-15 98488]

S3 V0230Vfx;V0230Vfx;c:\windows\system32\drivers\V0230Vfx.sys [2009-11-6 6272]

S3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\drivers\V0230VID.sys [2009-11-6 509760]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-10-26 13:23:23 -------- d-----w- c:\users\lennart\appdata\roaming\Malwarebytes

2010-10-26 13:23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-26 13:23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-26 13:23:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-26 13:23:08 -------- d-----w- c:\progra~2\Malwarebytes

2010-10-26 12:14:27 388608 ----a-w- C:\HijackThis.exe

2010-10-25 23:25:36 81920 ----a-w- c:\windows\eSellerateControl350.dll

2010-10-25 23:25:36 356352 ----a-w- c:\windows\eSellerateEngine.dll

2010-10-25 23:25:36 -------- d-----w- c:\program files\Rundll Errors Fix Wizard

2010-10-22 12:33:04 6146896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{98c8770f-b8ee-4542-b8f8-5aa42f220b93}\mpengine.dll